SAST False Positives
Why SAST tools report findings that are not genuine vulnerabilities, and how to triage, validate, and reduce false-positive findings without missing genuine vulnerabilities.
Primary question: What are SAST false positives and how should security teams handle them?
Direct answer
A SAST false positive is a reported finding whose asserted weakness or claimed data flow does not exist under the defined validation criteria. A genuine weakness with low, conditional, or currently absent exploitability remains a true positive and is handled through reachability, exploitability and risk assessment.
SAST false positives occur when a static analysis tool reports a finding whose asserted weakness or data flow is not present under the defined validation criteria. This happens because static analysis lacks runtime context, cannot always establish a complete data flow, or uses rules that match code patterns that are safe in the specific application's context.
Handling false positives requires structured triage — reviewing each finding for validity, data-flow completeness, and exploitability context. Reducing false positives at the source involves rule tuning, configuration adjustments, and framework-specific rule sets, while reducing the burden of triage involves automated evaluation and contextual analysis.
Definitions
False positive (SAST)
A SAST false positive is a reported finding whose asserted weakness or claimed data flow does not exist under the defined validation criteria. A genuine weakness with low, conditional, or currently absent exploitability remains a true positive and is handled through reachability, exploitability and risk assessment.
Triage
The process of reviewing SAST findings to determine which are genuine vulnerabilities requiring remediation and which are false positives that can be closed with documented rationale.
Precision (SAST)
The proportion of SAST-reported findings that are genuine vulnerabilities. High precision means most reported findings are valid; low precision means many reported findings are false positives. Precision is measured against a defined evaluation scope.
The engineering problem
High false-positive rates consume security team time, create alert fatigue, and risk causing genuine vulnerabilities to be dismissed through desensitization.
Rule tuning to reduce false positives may also reduce detection coverage, potentially increasing false negatives. Organizations must balance precision and recall.
Developers may dismiss SAST findings as unreliable when false-positive rates are high, reducing the overall effectiveness of the SAST program.
A finding reported by only one SAST tool is not automatically a false positive. It may simply be a vulnerability that only one tool's detection approach can identify.
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Structured triage
SAST finding triage- Artifact
- SAST findings reviewed for validity, data-flow completeness, and exploitability context.
- Risk
- Dismissing genuine vulnerabilities as false positives; wasting effort validating false positives.
- Output
- A triaged finding set with documented disposition for each finding — genuine vulnerability, false positive, or requires additional investigation.
Evidence:
Rule tuning
SAST rule configuration- Artifact
- SAST rule set adjusted to reduce false positives while maintaining acceptable detection coverage.
- Risk
- Reducing false positives at the cost of increased false negatives.
- Output
- A rule configuration that balances precision and recall for the specific codebase and technology stack.
Evidence:
Automated evaluation
AI-assisted triage- Artifact
- Contextual evaluation of SAST findings to support triage decisions.
- Risk
- Overreliance on automated evaluation without human validation for high-severity or ambiguous findings.
- Output
- Triage support artifacts with contextual assessments for manual validity review.
Evidence:
Verification workflow
- SAST produces findings for the codebase.
- Findings are triaged — reviewed for validity, data-flow completeness, and exploitability context.
- Contextual evaluation (if available) supports each finding's triage assessment.
- Genuine vulnerabilities are assigned for remediation; false positives are documented and closed with rationale; ambiguous findings are escalated for manual review.
- Rule tuning is applied based on triage outcomes to reduce recurring false positives while maintaining detection coverage.
- The cycle repeats for each new build or scan.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SAST analysis with DerTriage, available within static analysis to support finding review.
DerScanner performs static analysis and provides DerTriage, available within static analysis to support finding review. [derscanner-sast]
Limits of verification
- Rule tuning to reduce false positives may also reduce detection coverage. There is no configuration that eliminates all false positives without risking missed vulnerabilities.
- Automated triage tools may miss nuanced context. Human validation remains necessary for high-severity findings, ambiguous cases, and policy exceptions.
- False-positive rates vary by technology stack, code quality, and rule configuration. A rate acceptable in one codebase may be unacceptable in another.
- A finding unique to one SAST tool is not automatically a false positive — it may reflect genuine detection differences between tools.
Related knowledge
SAST False Negatives
The complementary problem of missed vulnerabilities
Relationship: related-toSAST Accuracy
How accuracy encompasses both false positives and false negatives
Relationship: related-toReducing SAST False Positives
Practical guidance on reducing false-positive generation and disposition burden
Relationship: related-toAI Vulnerability Triage
How AI-assisted triage evaluates SAST findings in context
Relationship: related-toValidate SAST Findings
How to validate individual SAST findings for accuracy and exploitability
Relationship: related-toCanonical terms used: SAST false positive; False positive triage; SAST precision; Over-reporting.
Evidence and references
- DerScanner SAST documentationDerScanner performs static analysis of supported source and binary formats, provides configuration-file analysis, and reports and compares analysis results. DerTriage and DerCodeFix are available within static analysis.
derscanner-sast
Finding triage